pmotadeee

🧠 FLATLINE - Protocole d'injection de conscience ATTENTION : Ceci n'est pas un jeu. C'est une interface cognitive pour le hacking de la réalité. 🎮 COMMENT JOUER Gameplay de base 1. Téléchargez les modules de conscience fichiers CSV depuis ce dépôt 2. Injectez-les directement dans les interfaces I...

CVE-2020-25398

CVE-2020-25398 Une injection CSV existe dans InterMind iMind Server jusqu'à la version 3.13.65 via la fonctionnalité d'exportation CSV. Informations Description : Un attaquant peut configurer des données spécifiques, qui pourraient être exportées vers un fichier CSV malveillant avec une charge...

CVE-2024-29375

CSV-Injection-PoC CSV-инъекция в Addactis IBNRS 3.10.3.107 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L CVSS: 7.1, Показатель влияния: 5.3, Показатель эксплуатации: 1.3 Затронутые компоненты: параметры Project Description, Identifiers, Custom Triangle Name внутри Input Triangles и Yield Curve Name Скриншо...

CVE-2023-33410

CVE-2023-33410 Minical 1.0.0 уязвим для CSV-инъекций. Разработчик: https://github.com/minical/minical Демо-приложение: https://demo.minical.io/ PoC Шаг 1: Перейдите в модуль "Учет" и нажмите "Создать нового клиента". Шаг 2: Введите полезную нагрузку в поле "Имя" и нажмите "Создать". Payload:...

CVE-2022-44830

Description suggérée L'application Sourcecodester Event Registration App v1.0 s'est avérée contenir de multiples vulnérabilités d'injection CSV via les champs Prénom, Contact et Remarques. Ces vulnérabilités permettent à des attaquants d'exécuter du code arbitraire via un fichier Excel malveillan...

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

CVE-2025-60852: Instant Developer Foundation 25.0.9600의 CSV 인젝션 – 개념 증명PoC 📌 개요 이 저장소에는 Instant Developer Foundation 프레임워크 25.0.9600 이전 버전로 빌드된 애플리케이션에 영향을 미치는 CSV 인젝션 Formula Injection 취약점CVE-2025-60852에 대한 개념 증명PoC이 포함되어 있습니다. 취약한 프레임워크로 빌드된 애플리케이션은 CSV 형식으로 데이터를 내보낼 때 사용자 입력을 제대로 필터링하지 않습니다...

CVE-2026-19501-poc

CVE-2026-19501 Poc Description: Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it. Step to reproduce: Step 1 : Submit a form and then intercept th...

CVE-2023-36250

CVE-2023-36250 Vulnérabilité d'injection CSV dans le gestionnaire de temps GNOME version 3.0.2, permettant à un attaquant local d'exécuter du code arbitraire via un fichier .tsv piégé lors de la création d'un nouvel enregistrement. Type de vulnérabilité Injection CSV Découvreur Bruno Teixeira...

EUVD-2026-77475

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula ma...

CVE-2026-86745

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86742

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

EUVD-2026-74922

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

EUVD-2026-74919

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-9852

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...

CVE-2026-9852

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...

CVE-2026-9852

CVE-2026-9852 is a CSV injection vulnerability in Hitachi Energy SYS600 , affecting the Notify service log export function on Windows. Injected malicious formulas in log data can modify spreadsheet data, insert links, exfiltrate data , and in some configurations execute malicious code on the user...

EUVD-2026-70321

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...

CVE-2026-76797

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...

CVE-2026-76797

The MongoSQL Transition Readiness Tool (MongoDB) is vulnerable to CSV injection through its generated reports. Database and collection names are written into CSV output without neutralizing leading characters that spreadsheet applications interpret as formulas. An attacker with write privileges o...